Applying firewalls to virtualized environments

ABSTRACT

Each virtualized environment on a computer has its own set of firewall rules. The virtualized environments share a single instance of the operating system image, a filter engine and a single network stack. A virtualized environment may be a compartment or a server silo. A virtualized environment is a network isolation mechanism and may be used to prevent use of a computer to traverse network boundaries by creating a separate virtualized environment for each network, enabling a separate set of rules to be applied to each virtualized environment and the network interfaces within it. Virtualized environments may also be used to assign different trust levels to the same physical network. Firewall rules are applied by virtualized environment identifier (ID), enabling separate filters to be applied to each virtualized environment on a computer. A virtualized environment may include or be associated with one or more network interfaces.

BACKGROUND

In construction, a firewall is a fireproof or fire-resistant walldesigned to prevent the spread of fire through a building or a vehicle.When the term is applied to a computer system, it refers to a securitysystem consisting of hardware, software or a combination thereof, thatlimits the exposure of a computer or computer network to attack fromunauthorized users. The firewall operates within a networked environmentto prevent communications forbidden by a security policy, (typicallydesigned by a system administrator). The firewall attempts to controltraffic between different zones of trust. One situation in which afirewall is commonly used is on local area networks that are connectedto the Internet to control traffic between the Internet (not trusted)and the internal network (highly trusted). Thus the goal of the firewallis to provide controlled connectivity between zones of differing trustlevels by enforcement of a security policy. The proper configuration offirewalls demands skill and a good understanding of network protocolsand computer security. Small mistakes can render a firewall worthless asa security tool.

SUMMARY

Each virtualized environment on a computer has its own set of firewallrules. Each virtualized environment is associated with a uniqueidentifier. The set of firewall rules that are applied to eachvirtualized environment is based on the unique identifier of thevirtualized environment. The virtualized environments may share a singleinstance of the operating system image, a single shared filter engineand a single shared network stack. When a computer is connected to twoor more separate networks, use of a separate virtualized environment foreach network prevents traversal of network boundaries and enables aseparate set of rules to be applied to each virtualized environment andthe network interfaces within it. When two or more virtualizedenvironments on one computer are connected to the same network,different virtualized environments may be used to isolate the sessionsor users using those virtualized environments so that a session or useris prevented from affecting another session or user's port space,routing tables or firewall rules for that network. A virtualizedenvironment may be a compartment or a server silo. A compartment is anetwork isolation mechanism and may be associated with a uniquecompartment identifier (ID). Firewall rules may be applied based on thecompartment identifier, enabling separate filters to be applied to eachcompartment on a computer. A compartment may include or be associatedwith one or more network interfaces.

A server silo is another kind of network isolation mechanism and may beassociated with a unique silo ID. Firewall rules may be applied based onthe silo ID, enabling separate filters to be applied to each silo on acomputer. A server silo may include one or more compartments. Firewallrules added by a silo administrator are automatically scoped so thatthey apply only to the silo the administrator manages. Systemadministrators may apply rules based on virtualized identifier (e.g., bycompartment ID or by silo ID) or may apply rules to all virtualizedenvironments on the computer.

All the virtualized environments on the computer may share a singleoperating system image, filter engine and network stack. To determinewhich rules stored in a rules database in the operating system areapplied to a piece of traffic, rules are tagged with a uniquevirtualized environment identifier. Only those rules which are taggedwith the virtualized environment ID to which the interface is associatedon which the traffic is sent or received are applied to traffic comingin or going out from that interface. Instead of a particular virtualizedenvironment ID, a range of IDs may be specified for the rules. Becausefilters are applied by virtualized environment ID when the filterprocesses a request, not when the filter is added, interfaces belongingto a particular virtualized environment have the filters applied to themautomatically, even if the interface is added to the virtualizedenvironment after the filters are set up.

BRIEF DESCRIPTION OF THE DRAWINGS

In the drawings:

FIG. 1 is a block diagram illustrating an exemplary computingenvironment in which aspects of the invention may be implemented;

FIGS. 2 and 3 are block diagrams of systems for applying firewall rulesto virtualized environments in accordance with some embodiments of theinvention;

FIG. 4 is a flow diagram of a method for setting up firewall rules forvirtualized environments in accordance with some embodiments of theinvention; and

FIGS. 5-6 are flow diagrams of methods for processing firewall rules invirtualized environments in accordance with some embodiments of theinvention.

DETAILED DESCRIPTION Overview

To set up a firewall, someone designs one or more rules. For example, arule might be: “Block all traffic except traffic coming in on port 80”or “Do not allow this application to talk to any network except thecorporate network”. These rules are translated into a form in which therule is represented in the operating system kernel (i.e., into a seriesof filters). The kernel portion of the operating system maintains adatabase of the translated rules. When incoming or outgoing traffic isdetected, the kernel applies the filters to the packets of informationmaking up the traffic. Packets that make it through the filters are senton and all others are discarded.

In some operating systems, when a new firewall rule is added, the ruleapplies by default to the whole machine, although in some cases,attributes can be added to the filter so that the filter only applies toa specific interface on the machine, or to a specific IP (Internetprotocol) address. When a computer is connected to two or more differentnetworks, the computer may have different degrees of trust for thedifferent networks to which it is connected. Similarly, when two or morevirtualized environments are connected to the same network, thedifferent virtualized environments may have different trust levels forthe network. Depending on the degree of trust, the computer may want torestrict access to its services (e.g., file and print sharing)differently for each network or trust level. In addition the computermay utilize different communications protocols (such as TCP/IP, IPsecand other commonly known protocols) on the different networks. Thereforeit would be helpful to be able to be able to apply one set of filters totraffic on one network and another set of filters to traffic on adifferent network or one set of filters to traffic to and from onevirtualized environment and another set of filters to traffic to andfrom another virtualized environment.

Traditionally, if the computer were divided into more than onecompartment, the same set of firewall rules would typically apply to allcompartments. For example, specifying that a port accepts or blocksincoming connections would affect that port in all the compartments onthe computer. Because filters can be restricted to only specificinterfaces or addresses, it is possible to apply filters to only thoseinterfaces within a specific compartment. This requires theadministrator or other entity adding the filter to query for theinterfaces in the compartment and then to either add the filter once foreach interface in the compartment or add a single filter whichexplicitly specifies the set of interfaces in the compartment. Aninterface moving into the compartment would not automatically have thefilters applied to it which correspond to the compartment and is likelyto still have the filters associated with its former compartmentassociated with it instead. This situation requires the administrator tomonitor and correct which filters are applied to interfaces as they moveinto and out of compartments. To address this situation, in accordancewith embodiments of the invention, the virtualized environmentidentifier or ID is added to the set of attributes provided by thefilter engine. When a filter is added, the client can specify avirtualized environment ID, or set or range of virtualized environmentIDs along with the operation that should be used to filter networktraffic. When the filter is applied, it is only applied to the networktraffic in the specified virtualized environment. In some embodimentsthe filter applies to all the interfaces in the virtualized environmentat the time the filter operation is performed rather than at the timethe filter is added. For example, suppose at the time filter 1 isapplied to compartment 1, interface 1 and 2 exist in compartment 1.Suppose later interface 3 is added to compartment 1. Filter 1 will beautomatically applied to interface 3. If a filter is not associated witha compartment ID, the filter is applied to all compartments.

For server silos, the compartment mechanism is extended to provide eachserver silo with its own default compartment. Each compartment is thenassociated with a particular server silo. Compartments belonging to aserver silo follow the same rules described above with respect tocompartments not associated with a server silo. Sessions and interfacesmay be only associated with compartments within the same server silo;that is, associations may not cross server silo boundaries. A serversilo can create a new compartment for its own use but is not allowed toaffect the compartments of other server silos. A process running in aserver silo in some embodiments of the invention is prohibited fromswitching its thread's compartment to a compartment outside the serversilo.

In some embodiments of the invention, server silos run on a sharedsingle-instance kernel, and only a single kernel-mode filter engineexists. A server silo may however be associated with its own user-modefilter engine. A server silo user-mode filter engine may communicatewith the kernel-mode filter engine but may not communicate with otherserver silo user-mode filter engines. In some embodiments of theinvention, server silos share a user-mode filter engine. Therefore todetermine when a filter should be applied, the virtualized environmentis utilized as the filter boundary. That is, when a filter is added froma server silo, if the filter specifies a compartment ID, the filterengine ensures that the compartment is within the same server silo. Ifit is not, the filter addition fails. If the filter does not specify acompartment ID, the filter is applied to the server silo, thus affectingall the traffic for the server silo (e.g., all traffic tagged with thesilo ID).

A silo is an intra-operating system isolation/containment mechanism thatprovides for the isolation of a process running on a computer. The siloenables the controlled sharing of some files and restricts access toother files by creating a view of the file system for the processrunning in the silo. Similarly, the silo controls sharing and restrictedaccess to the entries in the registry by creating a view of the registryfor the process running in the silo. The registry view appears to aprocess running in the silo to be a single registry which is the unionof two or more physical registries, the system registry and the registryon the removable medium.

Exemplary Computing Environment

FIG. 1 and the following discussion are intended to provide a briefgeneral description of a suitable computing environment in which theinvention may be implemented. It should be understood, however, thathandheld, portable, and other computing devices of all kinds arecontemplated for use in connection with the present invention. While ageneral purpose computer is described below, this is but one example,and the present invention requires only a thin client having networkserver interoperability and interaction. Thus, the present invention maybe implemented in an environment of networked hosted services in whichvery little or minimal client resources are implicated, e.g., anetworked environment in which the client device serves merely as abrowser or interface to the World Wide Web.

Although not required, the invention can be implemented via anapplication programming interface (API), for use by a developer, and/orincluded within the network browsing software which will be described inthe general context of computer-executable instructions, such as programmodules, being executed by one or more computers, such as clientworkstations, servers, or other devices. Generally, program modulesinclude routines, programs, objects, components, data structures and thelike that perform particular tasks or implement particular abstract datatypes. Typically, the functionality of the program modules may becombined or distributed as desired in various embodiments. Moreover,those skilled in the art will appreciate that the invention may bepracticed with other computer system configurations. Other well knowncomputing systems, environments, and/or configurations that may besuitable for use with the invention include, but are not limited to,personal computers (PCs), automated teller machines, server computers,hand-held or laptop devices, multi-processor systems,microprocessor-based systems, programmable consumer electronics, networkPCs, minicomputers, mainframe computers, and the like. The invention mayalso be practiced in distributed computing environments where tasks areperformed by remote processing devices that are linked through acommunications network or other data transmission medium. In adistributed computing environment, program modules may be located inboth local and remote computer storage media including memory storagedevices.

FIG. 1 thus illustrates an example of a suitable computing systemenvironment 100 in which the invention may be implemented, although asmade clear above, the computing system environment 100 is only oneexample of a suitable computing environment and is not intended tosuggest any limitation as to the scope of use or functionality of theinvention. Neither should the computing environment 100 be interpretedas having any dependency or requirement relating to any one orcombination of components illustrated in the exemplary operatingenvironment 100.

With reference to FIG. 1, an exemplary system for implementing theinvention includes a general purpose computing device in the form of acomputer 110. Components of computer 110 may include, but are notlimited to, a processing unit 120, a system memory 130, and a system bus121 that couples various system components including the system memoryto the processing unit 120. The system bus 121 may be any of severaltypes of bus structures including a memory bus or memory controller, aperipheral bus, and a local bus using any of a variety of busarchitectures. By way of example, and not limitation, such architecturesinclude Industry Standard Architecture (ISA) bus, Micro ChannelArchitecture (MCA) bus, Enhanced ISA (EISA) bus, Video ElectronicsStandards Association (VESA) local bus, and Peripheral ComponentInterconnect (PCI) bus (also known as Mezzanine bus).

Computer 110 typically includes a variety of computer readable media.Computer readable media can be any available media that can be accessedby computer 110 and includes both volatile and nonvolatile media,removable and non-removable media. By way of example, and notlimitation, computer readable media may comprise computer storage mediaand communication media. Computer storage media includes both volatileand nonvolatile, removable and non-removable media implemented in anymethod or technology for storage of information such as computerreadable instructions, data structures, program modules or other data.Computer storage media includes, but is not limited to, RAM, ROM,EEPROM, flash memory or other memory technology, CDROM, digitalversatile disks (DVD) or other optical disk storage, magnetic cassettes,magnetic tape, magnetic disk storage or other magnetic storage devices,or any other medium which can be used to store the desired informationand which can be accessed by computer 110. Communication media typicallyembodies computer readable instructions, data structures, programmodules or other data in a modulated data signal such as a carrier waveor other transport mechanism and includes any information deliverymedia. The term “modulated data signal” means a signal that has one ormore of its characteristics set or changed in such a manner as to encodeinformation in the signal. By way of example, and not limitation,communication media includes wired media such as a wired network ordirect-wired connection, and wireless media such as acoustic, RF,infrared, and other wireless media. Combinations of any of the aboveshould also be included within the scope of computer readable media.

The system memory 130 includes computer storage media in the form ofvolatile and/or nonvolatile memory such as read only memory (ROM) 131and random access memory (RAM) 132. A basic input/output system 133(BIOS), containing the basic routines that help to transfer informationbetween elements within computer 110, such as during start-up, istypically stored in ROM 131. RAM 132 typically contains data and/orprogram modules that are immediately accessible to and/or presentlybeing operated on by processing unit 120. By way of example, and notlimitation, FIG. 1 illustrates operating system 134, applicationprograms 135, other program modules 136, and program data 137.

The computer 110 may also include other removable/non-removable,volatile/nonvolatile computer storage media. By way of example only,FIG. 1 illustrates a hard disk drive 141 that reads from or writes tonon-removable, nonvolatile magnetic media, a magnetic disk drive 151that reads from or writes to a removable, nonvolatile magnetic disk 152,and an optical disk drive 155 that reads from or writes to a removable,nonvolatile optical disk 156, such as a CD ROM or other optical media.Other removable/non-removable, volatile/nonvolatile computer storagemedia that can be used in the exemplary operating environment include,but are not limited to, magnetic tape cassettes, flash memory cards,digital versatile disks, digital video tape, solid state RAM, solidstate ROM, and the like. The hard disk drive 141 is typically connectedto the system bus 121 through a non-removable memory interface such asinterface 140, and magnetic disk drive 151 and optical disk drive 155are typically connected to the system bus 121 by a removable memoryinterface, such as interface 150.

The drives and their associated computer storage media discussed aboveand illustrated in FIG. 1 provide storage of computer readableinstructions, data structures, program modules and other data for thecomputer 110. In FIG. 1, for example, hard disk drive 141 is illustratedas storing operating system 144, application programs 145, other programmodules 146, and program data 147. Note that these components can eitherbe the same as or different from operating system 134, applicationprograms 135, other program modules 136, and program data 137. Operatingsystem 144, application programs 145, other program modules 146, andprogram data 147 are given different numbers here to illustrate that, ata minimum, they are different copies. A user may enter commands andinformation into the computer 110 through input devices such as akeyboard 162 and pointing device 161, commonly referred to as a mouse,trackball or touch pad. Other input devices (not shown) may include amicrophone, joystick, game pad, satellite dish, scanner, or the like.These and other input devices are often connected to the processing unit120 through a user input interface 160 that is coupled to the system bus121, but may be connected by other interface and bus structures, such asa parallel port, game port or a universal serial bus (USB).

A monitor 191 or other type of display device is also connected to thesystem bus 121 via an interface, such as a video interface 190. Agraphics interface 182, such as Northbridge, may also be connected tothe system bus 121. Northbridge is a chipset that communicates with theCPU, or host processing unit 120, and assumes responsibility foraccelerated graphics port (AGP) communications. One or more graphicsprocessing units (GPUs) 184 may communicate with graphics interface 182.In this regard, GPUs 184 generally include on-chip memory storage, suchas register storage and GPUs 184 communicate with a video memory 186.GPUs 184, however, are but one example of a coprocessor and thus avariety of coprocessing devices may be included in computer 110. Amonitor 191 or other type of display device is also connected to thesystem bus 121 via an interface, such as a video interface 190, whichmay in turn communicate with video memory 186. In addition to monitor191, computers may also include other peripheral output devices such asspeakers 197 and printer 196, which may be connected through an outputperipheral interface 195.

The computer 110 may operate in a networked environment using logicalconnections to one or more remote computers, such as a remote computer180. The remote computer 180 may be a personal computer, a server, arouter, a network PC, a peer device or other common network node, andtypically includes many or all of the elements described above relativeto the computer 110, although only a memory storage device 181 has beenillustrated in FIG. 1. The logical connections depicted in FIG. 1include a local area network (LAN) 171 and a wide area network (WAN)173, but may also include other networks. Such networking environmentsare commonplace in offices, enterprise-wide computer networks, intranetsand the Internet.

When used in a LAN networking environment, the computer 110 is connectedto the LAN 171 through a network interface or adapter 170. When used ina WAN networking environment, the computer 110 typically includes amodem 172 or other means for establishing communications over the WAN173, such as the Internet. The modem 172, which may be internal orexternal, may be connected to the system bus 121 via the user inputinterface 160, or other appropriate mechanism. In a networkedenvironment, program modules depicted relative to the computer 110, orportions thereof, may be stored in the remote memory storage device. Byway of example, and not limitation, FIG. 1 illustrates remoteapplication programs 185 as residing on memory device 181. It will beappreciated that the network connections shown are exemplary and othermeans of establishing a communications link between the computers may beused.

One of ordinary skill in the art can appreciate that a computer 110 orother client device can be deployed as part of a computer network. Inthis regard, the present invention pertains to any computer systemhaving any number of memory or storage units, and any number ofapplications and processes occurring across any number of storage unitsor volumes. The present invention may apply to an environment withserver computers and client computers deployed in a network environment,having remote or local storage. The present invention may also apply toa standalone computing device, having programming languagefunctionality, interpretation and execution capabilities.

Applying Firewalls to Virtualized Environments

Different sets of firewall rules can be specified and applied to one ormore networks by associating the different networks or different trustlevels for the same network with different virtualized environments on acomputer having a shared operating system image, filter engine andnetwork stack. FIG. 2 illustrates a system 200 for applying firewallrules to virtualized environments in accordance with embodiments of theinvention. System 200 may reside on one or more computers such ascomputer 110 described above with respect to FIG. 1. System 200 includesa computer 110 connected to one or more different networks, representedin FIG. 1 by network 1 202 and network 2 204. In some embodiments of theinvention, the two networks, network 1 202 and network 2 204 representdifferent zones of trust. For example, network 1 202 may represent azone of little or no trust such as the Internet and network 2 204 mayrepresent a highly trusted zone such as a business' internal network.Alternatively, two or more virtualized environments may be connected tothe same network but assign different trust levels to the network.System 200 may include one or more virtualized environments. A singleinstance of an operating system 262 is shared by one or more virtualizedenvironments, represented in FIG. 2 by compartment 1 222 and compartment2 224, etc. Any number of additional compartments may be created. Insome embodiments of the invention, a computer will have at least onecompartment, denoted as the default compartment in which the systemservices execute. The service or system session in some embodiments ofthe invention is associated with the default compartment.

The operating system (e.g., OS 262) may represent a Microsoft WINDOWS,Mac OS (and Darwin), Unix, and Linux or other operating system. Theoperating system in some embodiments of the invention includes a filterengine 260 that applies the network firewall rules and a network stack260 a that is shared by all the applications and virtualizedenvironments running on the system. Rules may be stored in a filterdatabase 260 b stored in the operating system 262. In some embodimentsof the invention, the filter engine 260 provides a number of attributesthat may be specified when a new filter is added. Examples of theseattributes include specification of the local and remote IP addresses,the local and remote ports and the local interface the filter appliesto.

A compartment is a network isolation mechanism which is especiallyuseful when a computer is connected to two or more separate networks(e.g., in multi-homed personal computer (PC) scenarios), although itwill be appreciated that the invention as contemplated is not solimited. The isolation mechanism may operate in such a way that thecomputer cannot be used to traverse network boundaries by assigning useof a separate compartment for each network. In some embodiments of theinvention, each compartment is identified by a locally unique value (thecompartment identifier or compartment ID). Each session that runs on thecomputer, runs within a compartment. No sessions, one session or morethan one session may be associated with a particular compartment. Forexample, in FIG. 2, compartment 1 222 includes one session, session 1218 and compartment 2 224 includes multiple sessions, session 2 220,session 3 221, etc. Different sessions of the same application (e.g.,Application X) may run in different compartments. That is, session 1 218running in compartment 1 222 and session 2 220 running in compartment 2224 may both be sessions or instances of Application X or may besessions of different applications (e.g., Application X and ApplicationY). Similarly, session 2 220 and session 3 221 may both be sessions orinstances of Application X or may be sessions of different applications.

Computer 110 may also be associated with network interfaces. A networkinterface (also called a network interface card or NIC, network adaptoror network card) is a piece of hardware, software or combinationthereof, that enables a computer to communicate with a network. It is apoint of interconnection between a user terminal and a private or publicnetwork. In some embodiments of the invention, each network interface isassociated with a compartment. More than one network interface can beassociated with a particular compartment. Hence, each compartment isassociated with zero, one or more than one network interfaces. In someembodiments of the invention, to provide network isolation, eachcompartment is associated with and maintains its own routing informationand loopback interface. The separated routing information prohibitsnetwork traffic on the computer from being routed from a networkinterface in one compartment to a network interface in anothercompartment. In addition, in some embodiments of the invention, thecompartment serves as a boundary for port bind requests. When auser-mode application requests a port bind, even if the requestspecifies that the bind should be on all available addresses the bind islimited to only the interfaces within the same compartment as theapplication (determined by the session the application is running in.)Two separate application running in different compartments may bind tothe same port number without conflict. For kernel mode bind requests,the request may specify that the bind apply to all compartments. Thefilters applied may depend on the destination of the traffic (e.g., theinterface the traffic is received on which may map to a compartmentwhich may map to a server silo, etc.)

In some embodiments of the invention, a process running with theappropriate administrative privileges may switch one of its threads toanother compartment. By doing so, the process may take actions inmultiple compartments, including initiating connections, binding portsor indirectly forwarding traffic.

In FIG. 2 compartment 1 222 (an exemplary compartment) is associatedwith two network interfaces, interface 1 210 and interface 2 212.Compartment 2 224 is associated with two other network interfaces,interface 3 214 and interface 4 216. In general, any particularinterface will only exist in one compartment (e.g., one would not expectto see interface 1 in both compartment 1 and compartment 2.) When arequest such as request 1 206 is received from a network, such asnetwork 1 202, the request is received at the appropriate interface(e.g., interface 1 210), processed by the filter engine 260 and if therequest passes the filters associated with the compartment in which theinterface is located or with which the interface is associated (e.g.,interface 1 210 is associated with compartment 1 222 so the request mustpass the set of filters associated with compartment 1 222), the requestis sent to the appropriate session (e.g., to session 1 218.) Similarly,when, in FIG. 2 request 2 208 is received from network 2 204, therequest is received at interface 3 214), processed by the filter engine260 and if the request passes the filters associated with compartment 2224, the request is sent to the appropriate session (e.g., to session 2220.)

FIG. 3 illustrates embodiments of the invention in which the computerincludes one or more server silo virtualized environments. Each serversilo includes its own default compartment and may include one or moreadditional compartments as well. In FIG. 3, server silo 1 230 includesone compartment, compartment 1 222 and server silo 2 232 includescompartment 2 224. Server silos can create additional compartments fortheir own use. For example, server silo 2 232 can create one or moreadditional compartments such as compartment 3 226. Network interface 1210 and interface 2 212 are associated with compartment 1 222, interface3 214 is associated with compartment 2 224 and interface 4 216 isassociated with compartment 3 226. When a request such as request 1 206is received from a network, such as network 1 202, the request isreceived at the appropriate interface (e.g., interface 1 210), processedby the filter engine 260 and if the request passes the filtersassociated with the compartment in which the interface is located orwith which the interface is associated (e.g., interface 1 210 isassociated with compartment 1 222 so the request must pass the set offilters associated with compartment 1 222), the request is sent to theappropriate session (e.g., to session 1 218.) Similarly, when, in FIG. 3request 2 208 is received from network 2 204, the request is received atinterface 4 216), processed by the filter engine 260 and if the requestpasses the filters associated with compartment 2 224, the request issent to the appropriate session (e.g., to session 2 220.)

In some embodiments of the invention, server silos run on a singleinstance of the kernel of the operating system which is shared byeverything running on the computer. Filters added from a silo such asfrom silo 1 230 are not permitted to affect traffic to or from otherserver silos such as silo 2 232. Thus when server silo 2 232 adds afilter, the filter engine 260 checks to make sure that if server silohas specified that the filter is to apply to compartment 2 224, thatcompartment 2 224 is in server silo 2 232. If it were not, the filterwould not be added (the filter addition process would fail.) Similarly,if server silo 2 232 does not specify a compartment ID to which thefilter is to be applied, the filter is applied to the server silo bytagging the filter with the server silo ID (e.g., the filter would beapplied to compartments 2 226 and 3 226 and to any other compartmentssubsequently added to the silo).

FIG. 4 is a flow diagram of a method for setting up filters to apply tovirtualized environments. When setting up filters to apply tovirtualized environments (402), it appears to the administrator that heis setting up firewall rules that will apply to the entire computer.However, the operating system determines if the administrator is a siloadministrator or if he has system administrator credentials (404). Ifthe administrator is a system administrator, the administrator isallowed to specify the virtualized environments (406) to which the ruleapplies or the administrator can have the rule apply to all virtualizedenvironments on the computer (408). If the system administrator fails toidentify the virtualized environment to which the rule should apply, insome embodiments of the invention, the default behavior scopes the ruleto the infrastructure silo (the outermost or “system silo”) and allcompartments and or interfaces not belonging to a server silo. If theadministrator is a silo administrator (404), the administrator isallowed to specify the compartment(s) (412) to which the rule appliesor, if no compartments are specified, the filters are tagged (414) withthe server silo ID of the server silo associated with the siloadministrator. Rules tagged with a virtualized environment ID areapplied only to incoming and outgoing traffic in that virtualizedenvironment (410).

FIG. 5 is a flow diagram of applying filters to incoming traffic invirtualized environments in accordance with some embodiments of theinvention. At 502, a request is received on a particular interface in acompartment which may or may not be in a server silo. At 504, therequest is examined to determine which interface the request came in on.At 506 the compartment and server silo (if there is one) associated withthat interface is determined. At 508 the request is modified to includethe compartment and (optionally) server silo information if present, andthe request is sent on to the operating system. At 510, the appropriaterules for the compartment and server silo are applied by the filterengine to the request. Alternatively, the request including whichinterface the request came in on may be sent to the operating system,and the operating system may determine the compartment (and if present,server silo to which the interface belongs). If the incoming trafficpasses the security controls specified by the filters, the informationpacket or request is sent on to the application to which the packet wasaddressed.

FIG. 6 is a flow diagram of applying filters to outgoing traffic invirtualized environments in accordance with some embodiments of theinvention. At 602 an application running in a compartment notifies theoperating system that it wants to send outgoing traffic. The operatingsystem determines at 604 which compartment (and if present, which serversilo) the application is running in. At 606 when the request is on thenetwork stack, the operating system determines which interface therequest will be sent out over and applies the corresponding filters tothe request (608). If the outgoing traffic passes the security controlsspecified by the filters, the information packet or request is sent onto be sent over the wire to the application to which the packet wasaddressed. The filter engine may apply rules more than once in thestack. For example, rules may be applied after the operating systemdetermines at 604 which compartment (and if present, which server silo)the application is running in.

The various techniques described herein may be implemented in connectionwith hardware or software or, where appropriate, with a combination ofboth. Thus, the methods and apparatus of the present invention, orcertain aspects or portions thereof, may take the form of program code(i.e., instructions) embodied in tangible media, such as floppydiskettes, CD-ROMs, hard drives, or any other machine-readable storagemedium, wherein, when the program code is loaded into and executed by amachine, such as a computer, the machine becomes an apparatus forpracticing the invention. In the case of program code execution onprogrammable computers, the computing device will generally include aprocessor, a storage medium readable by the processor (includingvolatile and non-volatile memory and/or storage elements), at least oneinput device, and at least one output device. One or more programs thatmay utilize the creation and/or implementation of domain-specificprogramming models aspects of the present invention, e.g., through theuse of a data processing API or the like, are preferably implemented ina high level procedural or object oriented programming language tocommunicate with a computer system. However, the program(s) can beimplemented in assembly or machine language, if desired. In any case,the language may be a compiled or interpreted language, and combinedwith hardware implementations.

While the present invention has been described in connection with thepreferred embodiments of the various figures, it is to be understoodthat other similar embodiments may be used or modifications andadditions may be made to the described embodiments for performing thesame function of the present invention without deviating therefrom.Therefore, the present invention should not be limited to any singleembodiment, but rather should be construed in breadth and scope inaccordance with the appended claims.

1. A system for applying separate firewall rules to one or more networks connected to a computer comprising: a shared instance of an operating system comprising a shared filter engine and network stack shared by a plurality of virtualized environments on the computer, wherein a subset of a set of firewall rules stored in the filter engine is applied to traffic from or traffic to a network, based on a virtualized environment identifier.
 2. The system of claim 1, wherein a virtualized environment of the plurality of virtualized environments is a compartment, comprising a network isolation mechanism.
 3. The system of claim 1, wherein a virtualization environment of the plurality of virtualized environments is a server silo, wherein the server silo restricts resources available to a process running in the server silo.
 4. The system of claim 3, wherein the server silo comprises a plurality of compartments comprising network isolation mechanisms.
 5. The system of claim 1, wherein the plurality of virtualization environments comprises a first virtualized environment connected to a first network associated with a first trust level and a second virtualized environment connected to a second network associated with a second trust level different than the first trust level.
 6. The system of claim 5, wherein the first network and the second network are an identical physical network.
 7. The system of claim 5, wherein the first network and the second network are different physical networks.
 8. The system of claim 5, wherein a first set of filters are applied to incoming and outgoing traffic on the first network and a second set of filters are applied to incoming and outgoing traffic on the second network, wherein the first set of filters is associated with the first virtualized environment and the second set of filters is associated with the second virtualized environment.
 9. A method for assigning a filter to incoming and outgoing traffic on a network comprising: receiving a rule to be applied to incoming or outgoing traffic over a network; and determining that an administrator entering the rule to be applied to incoming or outgoing traffic over the network is an administrator of a virtualized environment, and in response thereto scoping the rule to the virtualized environment.
 10. The method of claim 9, wherein the rule is scoped to the virtualized environment by tagging a filter implementing the rule with a unique identifier associated with the virtualized environment.
 11. The method of claim 10, further comprising applying the rule only to traffic sent to or received from a session executing in the virtualized environment.
 12. The method of claim 10, wherein the virtualized environment is a network isolation mechanism comprising a compartment or a server silo.
 13. The method of claim 9, wherein the network is a first network associated with a first trust level and a first set of rules is applied to the first network by tagging the first set of rules with a first virtualized environment identifier and a second set of rules is applied to a second network associated with a second trust level by tagging the second set of rules with a second virtualized environment identifier.
 14. The method of claim 13, wherein the first network and the second network are an identical physical network.
 15. A removable computer-readable medium having program code stored thereon that, when executed by a computing environment, causes the computing environment to: receive incoming or outgoing traffic associated with a session running in a first virtualized environment on a computer, wherein the computer comprises a plurality of virtualized environments comprising the first virtualized environment and a second virtualized environment, wherein the plurality of virtualized environments on the computer share a single operating system image, a single filter engine and a single network stack, wherein the first virtualized environment is associated with a first set of rules to be applied to traffic on a first network connected to the computer and the second virtualized environment is associated with a second set of rules to be applied to a second network connected to the computer.
 16. The computer-readable medium of claim 15, having further program code stored thereon, that when executed by the computing environment, causes the computing environment to: determine the interface on which the incoming traffic came in; determine the virtualized environment associated with the interface; and apply the first set of rules to the incoming traffic by matching a unique identifier of the virtualized environment with an attribute present on the first set of rules, wherein only those rules having an attribute matching the unique identifier are applied.
 17. The computer-readable medium of claim 15, having further program code stored thereon, that when executed by the computing environment, causes the computing environment to: determine that a virtualized environment associated with the session originating the outgoing traffic is the first virtualized environment and in response thereto, apply the first set of rules to the outgoing traffic.
 18. The computer-readable medium of claim 17, having further program code stored thereon, that when executed by the computing environment, causes the computing environment to: determine an interface associated with the first virtualized environment, the interface connected to the first network.
 19. The computer-readable medium of claim 16, having further program code stored thereon, that when executed by the computing environment, causes the computing environment to: associate a unique identifier with the first virtualization environment and tag the first set of rules with the unique identifier.
 20. The computer-readable medium of claim 19, having further program code stored thereon, that when executed by the computing environment, causes the computing environment to: apply only a set of rules to the traffic based on matching the unique identifier with an identifier associated with the traffic. 